Betteridge’s Legislation of Headlines insists that any headline posed as a query can immediately be answered with a easy “No.”
Apparently, the speculation behind this witticism (it’s not truly a Legislation, nor but a rule, nor even in reality something greater than a suggestion) is that if the creator knew what they had been speaking about, and had actual proof to assist their case, they’d have written the headline as an undiluted truth.
Properly, we’re not journalists right here on Bare Safety, so happily we’re not sure by this legislation.
The ruthless reply to our personal query within the headline above is, “Nobody is aware of besides Apple, and Apple isn’t saying.”
A greater however admittedly middle-of-the-road reply is, “Wait and see.”
Fast responses
This story began late yesterday, on the tail finish of 2023-06-10 UK time, after we excitedly [do you mean ‘excitably?’ – Ed.] wrote an advisory about Apple’s second-ever Fast Safety Response (RSR):
These RSRs are, as we defined beforehand, Apple’s effort to ship single-issue emergency fixes as promptly as well-managed open supply mission usually do, the place zero-day patches typically come out inside a day or two of an issue being discovered, with updates-to-the-updates following promptly if additional investigations reveal additional points needing to be mounted.
One motive open supply initiatives can take this type of method is that they normally present a obtain web page with the complete supply code of each officially-released model ever, in order that should you rush to undertake the most recent fixes in hours, moderately than in days or even weeks, and so they don’t work out, there’s no barrier to rolling again to the earlier model till the fix-for-the-fix is prepared.
Apple’s offical improve pathway, nonetheless, a minimum of for its cellular units, has all the time been to provide full, system-level patches that may by no means be rolled again, as a result of Apple doesn’t like the concept of customers intentionally downgrading their very own programs with a view to exploit outdated bugs for the aim of jailbreaking their very own units or putting in various working programs.
Because of this, even when Apple produced emergency one-bug or two-bug fixes for zero-day holes that had been already being actively exploited, the corporate wanted to provide you with (and also you wanted to place your religion in) what was basically a one-way improve, despite the fact that all you actually wanted was a minmalistic replace to 1 element of the system to patch a transparent and current hazard.
Enter the RSR course of, permitting fast patches that you could set up in a rush, that don’t require you to take your telephone offline for 15 to 45 minutes of repeated reboots, and that you could later take away (and reinstall, and take away, and so forth) should you resolve that the remedy was worse than the illness.
Bugs patched quickly through an RSR can be patched completely within the subsequent full model improve…
…in order that RSRs don’t want or get an entire new model variety of their very own.
As an alternative, they get a sequence letter appended, in order that the primary Fast Safety Response for iOS 16.5.1 (which got here out yesterday) is displayed in Settings > Basic > About as 16.5.1 (a).
(We don’t know what occurs if the sequence ever goes previous (z), however we’d be keen to take a small wager on the reply being (aa), or maybe (za) if alphabetic sortability is taken into account essential.)
Right here at present, gone tomorrow
Anyway, only a few quick hours after advising everybody to get iOS and iPadOS 16.5.1 (a), as a result of it fixes a zero-day exploit in Apple’s WebKit code and will subsequently nearly definitely be abused for malware nastinesses corresponding to implanting adware or grabbing personal information out of your telephone…
…commenters (particular due to John Michael Leslie, who posted on our Fb web page) began reporting that the replace was now not displaying up once they used Settings > Basic > Software program Replace to attempt to replace their units.
Apple’s personal safety portal nonetheless lists [2023-07-11T15:00:00Z] the latest udpates as macOS 13.4.1 (a) and iOS/iPadOS 16.5.1 (a), dated 2023-07-10, with no notes about whether or not they’ve formally been suspended or not.
However reviews through the MacRumors web site recommend that the updates have been withdrawn in the intervening time.
One recommended motive is that Apple’s Safari browser now identifies itself in net requests with a Person-Agent string that features the appendage (a) in its veraion quantity.
Right here’s what we noticed after we pointed our up to date Safari browser on iOS at a listening TCP socket (formatted with line breaks to enhance legibility):
$ ncat -vv -l 9999
Ncat: Model 7.94 ( https://nmap.org/ncat )
Ncat: Listening on :::9999
Ncat: Listening on 0.0.0.0:9999
Ncat: Connection from 10.42.42.1.
Ncat: Connection from 10.42.42.1:13337.
GET / HTTP/1.1
Host: 10.42.42.42:9999
Improve-Insecure-Requests: 1
Settle for: textual content/html,utility/xhtml+xml,
utility/xml;q=0.9,*/*;q=0.8
Person-Agent: Mozilla/5.0 (iPhone;
CPU iPhone OS 16_5_1 like Mac OS X)
AppleWebKit/605.1.15 (KHTML, like Gecko)
Model/16.5.2 (a)
Cellular/15E148 Safari/604.1
Settle for-Language: en-GB,en;q=0.9
Settle for-Encoding: gzip, deflate
Connection: keep-alive
NCAT DEBUG: Closing fd 5.
Based on some MacRumors commentators, that Model/ string, consisting because it does of the standard numbers and dots together with some bizarre and sudden textual content in spherical brackets, is complicated some web sites.
(Sarcastically, the websites we’ve seen blamed on this apparently version-string-misparsing-blame-game all appear to be companies which might be rather more generally accessed by devoted apps than through a browser, however the principle appears to be that they apparently choke on that 16.5.2 (a) model identifier should you resolve to go to them with an up to date model of Safari.)
What to do?
Strictly talking, solely Apple is aware of what’s happening right here, and it’s not saying. (At the least, not formally through its safety portal (HT201222) or its About Fast Safety Responses web page (HT201224.)
We propose, if you have already got the replace, that you just don’t take away it except it genuinely interferes together with your skill to make use of your telephone with the web sites or apps you want for work, or except your individual IT division explicitly tells you to roll again to the “non-(a)” flavour of macOS, iOS or iPadOS.
In any case, this replace was deemed appropriate for a fast response as a result of the exploit it fixes is an in-the-wild, browser-based distant code execution (RCE) gap.
If you happen to do want or want to take away the RSR, you are able to do this:
- If in case you have an iPhone or iPad. Go to Settings > Basic > About > iOS/iPadOS Model and select Take away Safety Response.
- If in case you have a Mac. Go to System Settings > Basic > About and click on the
(i)icon on the finish of merchandise entitled macOS Ventura.
Be aware that we put in the RSR immediately on macOS Ventura 13.4.1 and iOS 16.5.1, and haven’t had any issues shopping to our typical net haunts through Safari or Edge. (Keep in mind that all browsers use WebKit on Apple cellular units!)
Due to this fact we don’t intend to take away the replace, and we’re not keen to take action experimentally, as a result of we don’t know whether or not we’ll be capable of reinstall it once more afterwards.
Commenters have recommended that the patch merely doesn’t get reported once they attempt from an unpatched gadget, however we haven’t tried re-patching a previously-patched gadget to see if that offers you a magic ticket to fetch the replace once more.
Merely put:
- If you happen to’ve already downloaded macOS 13.4.1 (a) or iOS/iPadOS 16.5.1 (a), hold the replace except you completely need to do away with it, on condition that it’s securing you towards a zero-day gap.
- If you happen to put in it and really want or need to take away it, see our directions above, however assume that you just received’t be capable of reinstall it later, and can subsequently put your self into the third class under.
- If you happen to haven’t obtained it but, watch this area. We’re guessing that the
(a)patch will quickly get replaced by a(b)patch, as a result of the entire thought of those “lettered updates” is that they’re meant to be fast responses. However solely Apple is aware of for positive.
We’ll patch our typical recommendation from yesterday by saying: Don’t delay; do it as quickly as Apple and your gadget will allow you to.
